ELC 2013 Security: Best Practices for Embedded Systems
summary
Starts with a hardware root of trust: secure boot plus a hardware crypto module with one‑time programmable keys and a true RNG, and warns not to reuse a master key across devices. Recommends tamper detection, encrypted filesystems (ecryptfs) for data at rest, TLS for data in motion, and entropy sources like haveged. Use LSMs (SE‑Linux, AppArmor, SMACK), containers/namespaces, compiler hardening flags (fstack-protector, _FORTIFY_SOURCE_), Valgrind/gcov/static analyzers, Metasploit/Armitage and pen tests, close ports and use cgroups/quotas. Few faulted ciphertexts can break RSA so plan for fault and power analysis defenses.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:43Overview Embedded system, not IT system
- 2:59Black Hats
- 6:13Hardware Crypto Module
- 7:33Design Best Practices (continued)
- 11:51Protect your Data
- 13:02Development Best Practices Code Reviews
- 15:37Testing Best Practices
- 16:26Static Analysis Tools
- 18:52Dynamic Analysis Tools Omalloc, Electric Fence, mtrace, mpatrol,...
- 20:22Pre-Deployment Best Practices
- 26:37The Defense
- 29:08Security Methodology
- 30:05DREAD Damage potential
related talks
59mGetting Started with Embedded Linux Security
14mHow not to secure your embedded system, lessons from automotive testing
45mNavigating Security Tradeoffs in Embedded Linux Systems
34mAuthenticated and Encrypted Storage on Embedded Linux
32mEmbedded Linux Security: Dr Jekyll and Mr Hyde
53mSecure Embedded Linux Product - A Success Story
43mShhh - Stop Sharing Secrets, a Secure Mindset for Embedded Development
48mSecurity today: change your habits and make it safer and efficient